Site Probing is the initial reconnaissance phase of any web application attack. The attacker systematically maps the web application’s structure, pages, parameters, OS, database, and infrastructure — building a complete profile before launching targeted exploits.
Probing Methodology
- OS Detection: Identify via HTTP response headers, file extensions, or automated tools.
- Infrastructure Mapping: Directory traversal, database server identification, content platform discovery.
- Application Scanning: Map all pages, dynamic parameters, cookies, and transaction flows.
Attacker Techniques During Probing
| Technique | Goal |
|---|---|
| Non-Existent URLs | Generate error messages that reveal application structure |
| Long Parameter Values | Detect buffer overflow candidates |
| Unauthorized Path Access | Find unprotected admin paths (/iisadmin/, /iissamples/) |
| Adding/Removing Parameters | Identify required vs optional parameters per URL |
Important: Ports 80 and 443 must remain open for business. Traditional firewalls and IDS/IPS do not protect against application-layer probing — a dedicated Web Application Firewall (WAF) is required.
Prevention Guidance
- Disable unnecessary protocols and lock down ports with firewall rules.
- Configure web servers to suppress banner information.
- Deploy an IDS configured to detect and reject scanning patterns.
CISSP Made Easy 